a2aproject a2a-rs inmemory.rs update race condition
Impact
A race condition flaw in a2aproject a2a-rs up to version 0.4.4 may be exploited remotely, affecting the InMemoryTaskStore::update function. The issue is described as a security flaw. A patch is available to correct this issue.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
a2aproject · VulDB
a2a-rs
5 ranges
a2aproject · VulDB
a2a-rs
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
Other versions: unknown
Product identifiers (CPE)
cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*Original source description
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-113707View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.